Claude Code app security: permissions, secrets and a pre-launch check

Abstract render of a stack of thin glass layers where one repaired layer glows green

By the FixMyVibe team · Last reviewed 16 October 2026

Claude Code can edit files and run commands, so secure two things: your environment (keep it updated, keep secret files behind deny rules, review commands and MCP servers before approving) and the app it builds (no keys in the repo, tight database rules). Anthropic's own guidance: you are responsible for reviewing proposed code and commands before approval.

Scan my repo free (read-only)See an example report

Two different things to secure

Your environment: Claude Code reads files, edits code and runs commands on your machine, and prompt injection (instructions hidden in files, web pages or tool output) tries to abuse that. Your app: once deployed, leaked keys and open database rules are what attackers look for.

The typical risks

1. Broad permissions

The permission mode decides what Claude Code may do without asking. In Manual mode it starts read-only and asks before edits and commands; Auto mode lets a classifier review actions instead of you. Anthropic notes that its working-directory boundary is a permission prompt, so an approved Bash command can still write anywhere your user account can. Use the sandboxed Bash tool or a dev container when you want an OS-level boundary.

2. Secrets within reach

Add deny rules for secret files (for example Read(./.env)) and keep production keys off your development machine where you can. A key pasted into a chat can end up hardcoded in a file and committed; see leaked API keys.

3. MCP servers and untrusted repositories

Project MCP servers live in .mcp.json and have their own approval prompt. Anthropic says it does not security-audit MCP servers and recommends using servers you wrote or trust. Claude Code shows a workspace trust dialog for new folders in interactive sessions; a -p (non-interactive) session shows neither prompt.

4. Outdated versions

CVE-2025-54795 (below 1.0.20) let crafted content bypass the confirmation prompt and run a command. Anthropic's advisory says auto-update delivered the fix. If you disabled auto-update, update now.

5. Open database rules

If the app uses Supabase from the browser, check RLS on every table: Supabase RLS check.

What the free FixMyVibe scan checks

Paste the URL of a public GitHub repository. The free scan reads the code read-only on a temporary copy that is deleted afterwards, and looks for:

  • Hardcoded secrets in the current files: API keys, tokens, Supabase secret/service_role keys, private keys, and secrets exposed through NEXT_PUBLIC_/VITE_ variables or committed build output.
  • Supabase database rules in your committed SQL migrations: tables without RLS, USING (true)/WITH CHECK (true) policies, policies that trust user_metadata, and similar patterns.

What it does not do: it does not scan your git history (only the current files), it does not connect to your database or your live Claude Code-built app, and it cannot see private repositories. Dependency checks against the OSV vulnerability database are part of the paid audits, not the free scan. It is an automated code scan, not a penetration test.

Pre-launch checklist

  1. Keep Claude Code on auto-update (or update now).
  2. Add deny rules for .env files and other secret paths; consider the sandboxed Bash tool.
  3. Review commands and file changes before approving; be careful with broad allow rules.
  4. Only approve MCP servers you trust; review .mcp.json changes in pull requests.
  5. Run /security-review on your branch, then review the diff for hardcoded keys.
  6. Check RLS on every Supabase table, then scan the repository.
Scan my repo free (read-only)See an example report

FAQ

How do I stop Claude Code from reading my .env file?

Add a deny rule such as Read(./.env) in your Claude Code permission settings. Anthropic's docs describe deny rules as part of the permission system; for enforcement that doesn't depend on how a command is written, they point to the sandboxed Bash tool.

What was CVE-2025-54795?

A command-parsing flaw in Claude Code below 1.0.20 that could bypass the confirmation prompt and run an untrusted command, if an attacker could get content into Claude Code's context. It was fixed in 1.0.20; Anthropic says versions before 1.0.24 are deprecated and were forced to update.

Does Claude Code review its own code for security?

It can: Anthropic documents a /security-review command for an on-demand security pass over the changes on your branch. That's a useful step, and an independent scan of the repository is a cheap second opinion.

Does FixMyVibe check my Claude Code setup?

No. The free scan reads the app code in a public GitHub repository for hardcoded secrets and Supabase RLS problems. It doesn't inspect your Claude Code settings, permissions or MCP servers.

Sources

FixMyVibe is an automated code scan, not a full penetration test, and cannot guarantee that an app is secure. What happens to your code during a scan: see our privacy policy.